From a2d04f48061719bd40332101e23483c0057683e3 Mon Sep 17 00:00:00 2001
From: Moxie Marlinspike <moxie@thoughtcrime.org>
Date: Thu, 8 Mar 2018 16:39:57 -0800
Subject: [PATCH] Prevent us from sql injecting ourselves on backup/restore

Fixes #7478
---
 src/org/thoughtcrime/securesms/backup/FullBackupExporter.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/org/thoughtcrime/securesms/backup/FullBackupExporter.java b/src/org/thoughtcrime/securesms/backup/FullBackupExporter.java
index 20f0a32e05..1eaaa73d31 100644
--- a/src/org/thoughtcrime/securesms/backup/FullBackupExporter.java
+++ b/src/org/thoughtcrime/securesms/backup/FullBackupExporter.java
@@ -143,7 +143,7 @@ public class FullBackupExporter extends FullBackupBase {
           for (int i=0;i<cursor.getColumnCount();i++) {
             if (cursor.getType(i) == Cursor.FIELD_TYPE_STRING) {
               statement.append('\'');
-              statement.append(cursor.getString(i));
+              statement.append(cursor.getString(i).replace("'", "\\'"));
               statement.append('\'');
             } else if (cursor.getType(i) == Cursor.FIELD_TYPE_FLOAT) {
               statement.append(cursor.getFloat(i));